The protection of your personal data is of great importance to us. Below we inform you about how we process your personal data when you use our website www.enroush.de (“Website”) and in connection with our services.

1. Controller

Enroush Benelux B.V.
Westerplantage 5
8911 DC Leeuwarden
The Netherlands Registered with the Dutch Chamber of Commerce (KvK)
Registration number: 96171251
Email: privacy@enroush.de

Within the meaning of Article 4(7) GDPR, the controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Joint Controllers
Enroush Benelux B.V. acts as a Joint Controller together with:
ENROUSH SRL
Frunzei Street no. 26
021534 Bucharest
Romania
Trade Registry no. J2017000295404
Enroush Benelux B.V. and ENROUSH SRL jointly determine certain purposes and means of processing personal data, particularly regarding:
Hosting and operation of the e-commerce platform
Order and subscription management
Customer service
IT infrastructure and backend systems
Invoicing systems administration
Marketing communications (email and SMS)
Operational and technical support
A Joint Controller Agreement has been concluded pursuant to Article 26 GDPR. The essence of this arrangement is available upon request.

2. Legal Bases for Processing

We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR), in particular on the basis of:
Art. 6(1)(b) GDPR – performance of a contract / pre-contractual measures
Art. 6(1)(c) GDPR – legal obligation
Art. 6(1)(a) GDPR – consent
Art. 6(1)(f) GDPR – legitimate interest

3. Purposes of Processing

We process personal data for the following purposes:
a) Contract Performance and Order Processing
(e.g., order processing, payment, shipping, returns, customer service)
Legal basis: Art. 6(1)(b) GDPR
b) Compliance with Legal Obligations
(e.g., tax and commercial retention obligations)
Legal basis: Art. 6(1)(c) GDPR
c) Customer Communication
(e.g., responding to email inquiries)
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient communication)
d) Newsletter & Direct Marketing
You will receive newsletters only if:
You have explicitly consented, and
We use the double opt-in procedure.
Consent is voluntary and may be withdrawn at any time.
Legal basis: Art. 6(1)(a) GDPR
e) Website Analytics & Optimisation
(e.g., reach measurement, website improvement)
Processing occurs solely based on your consent via our cookie banner.
Legal basis: Art. 6(1)(a) GDPR
Further details can be found in our Cookie Policy.

4. Categories of Personal Data Processed

Depending on your interaction with our Website, we may process:
Name and address
Email address
Order and payment data
IP address
Device and browser data
Usage data
Communication content
We do not intentionally process special categories of personal data within the meaning of Article 9 GDPR. If such data is transmitted to us inadvertently, it will be deleted immediately.

5. Disclosure of Data

Personal data will only be disclosed where necessary, for example to:
Payment service providers
Shipping and logistics partners
IT and hosting service providers
Customer support platforms
Marketing and analytics providers
All recipients are contractually obligated to comply with GDPR requirements.

6. International Data Transfers

Personal data may be processed jointly with ENROUSH SRL in Romania. Romania is a Member State of the European Union; therefore, no additional transfer mechanism is required for transfers within the EU.
Where personal data is transferred to third countries (e.g., the United States), such transfers occur only if:
They are necessary, and
Appropriate safeguards exist pursuant to Article 46 GDPR, particularly:
EU Standard Contractual Clauses (SCCs)
Additional technical and organisational measures

7. Retention Period

We store personal data only as long as necessary for the respective purpose:
Contract data: duration of the contractual relationship plus statutory retention periods
Tax and invoice data: up to 10 years (German commercial and tax law)
Marketing data: until withdrawal of consent

8. Your Rights

You have the following rights at any time:
Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent (Art. 7(3) GDPR)
Requests may be sent to: privacy@enroush.de
The first copy of personal data is provided free of charge.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.
For Germany, this may be the competent Data Protection Authority (Datenschutzbehörde) of your federal state. General information is available at:
www.bfdi.bund.de

10. Minors

Our Website is not intended for children under 16 years of age.
Persons under 16 may not submit personal data to us.

11. Data Security

We implement appropriate technical and organisational measures to protect your data against:
Unauthorised access
Loss
Manipulation
Misuse
Employees are trained in data protection requirements.

12. Cookies

Our Website uses cookies.
Further details can be found in our Cookie Policy.

13. Updates to this Privacy Policy

This Privacy Policy may be updated from time to time.
The current version is always available on the Website.
Last updated: April 2025
ENROUSH BENELUX B.V.